It's extremely common for a "leak" to actually be fully intentional, but the organization in question just wants plausible deniability to mitigate legal/politic

It's extremely common for a "leak" to actually be fully intentional, but the organization in question just wants plausible deniability to mitigate legal/political/popular blowback. In order to preserve plausible deniability, the leak will look genuine in all aspects that are easy to simulate. "Someone else did it" is easy to simulate. A better gauge would be to see if anyone is caught and punished. If so, it was probably a real leak.